IBM InfoSphere BigInsights 4.2.0/4.2.5 cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in IBM InfoSphere BigInsights 4.2.0/4.2.5. This affects an unknown part. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2017-1554. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in IBM InfoSphere BigInsights 4.2.0/4.2.5 (Reporting Software). It has been declared as critical. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 131398.

The bug was discovered 10/25/2017. The weakness was published 11/01/2017 (Website). The advisory is shared for download at ibm.com. This vulnerability was named CVE-2017-1554 since 11/30/2016. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/21/2021). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (131398) and SecurityFocus (BID 101588†). Similar entries are available at VDB-108878 and VDB-108879. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Reporting Software

Vendor

• IBM

Name

• InfoSphere BigInsights

Version

• 4.2.0
• 4.2.5

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion